GMO Internet has confirmed a large cyberattack on its Onamae.com Desktop Cloud service, a virtual desktop platform used in part for automated foreign exchange trading. The company said attackers gained unauthorized access to infrastructure and stole user data, raising the possibility that trading credentials stored on customer servers were exposed.

The incident has already led to reports of unauthorized trades and financial losses. GMO said up to 26,739 servers were potentially at risk, although that figure refers to systems that may have been affected rather than a confirmed count of compromised servers.

Attack timeline and affected service

According to the company, the investigation began on October 19 after customer reports signaled a problem. Malware was found the following day, and GMO started a phased shutdown of servers on October 21 as specialists examined the intrusion.

GMO said the breached service was Onamae.com Desktop Cloud, which it owns and operates. The platform provides cloud-based virtual desktop infrastructure and is also used by some customers to run automated trading tools in the Forex market.

Potential access to trading accounts

The company confirmed vulnerabilities, unauthorized access to internal infrastructure, and a leak of user information. It said attackers may have obtained MetaTrader 4 and MetaTrader 5 credentials that had been stored on client servers, creating a risk that outsiders could directly interfere with trading activity.

Some customers later reported trades being placed without their consent. TV Asahi cited a 44-year-old resident of Kanagawa Prefecture who estimated losses from unauthorized transactions at more than 6 million yen. GMO said the full scale of customer losses has not yet been determined and that the investigation is continuing.

Extortion claim and GMO response

The attacker allegedly demanded payment and threatened to publish confidential information, disrupt customer accounts linked to more than 70 brokerage and Forex firms, and carry out ransomware attacks. GMO said it refused to comply and instead submitted materials to police.

The company also said it coordinated with financial platforms to block suspicious transactions and forcibly end active sessions. As part of its response, GMO pledged to reimburse confirmed losses tied to unauthorized trades, including trading losses and related fees. Customers seeking compensation must submit transaction records and evidence showing interference, while lost profits and indirect damages are excluded.

Compensation and what comes next

Beyond case-by-case reimbursement, GMO said every active user of the service will receive 5,000 yen. It also plans to provide an alternative platform with six months of free service for affected customers.

After the breach, GMO asked the Japanese government to apply the country's active cyber defense mechanism, which took effect on October 1, 2026. Under that framework, police and the Self-Defense Forces may intervene in attackers' infrastructure under legal conditions. The government said any decision to use the mechanism rests with authorized agencies, not the victim organization, and it has not confirmed whether it was used in the GMO case.

Source: incrypted.com